Skip to content

Commit 95f3813

Browse files
[PR #3472] modified rule: Attachment: DOCX with hyperlink targeting recipient address
1 parent f0795fc commit 95f3813

File tree

1 file changed

+1
-12
lines changed

1 file changed

+1
-12
lines changed

detection-rules/3472_attachment_docx_hyperlink_targeting_recipient.yml

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -15,16 +15,6 @@ source: |
1515
)
1616
)
1717
)
18-
and (
19-
(
20-
profile.by_sender().prevalence in ("new", "outlier")
21-
and not profile.by_sender().solicited
22-
)
23-
or (
24-
profile.by_sender().any_messages_malicious_or_spam
25-
and not profile.by_sender().any_messages_benign
26-
)
27-
)
2818
2919
attack_types:
3020
- "Credential Phishing"
@@ -36,8 +26,7 @@ detection_methods:
3626
- "File analysis"
3727
- "Archive analysis"
3828
- "XML analysis"
39-
- "Sender analysis"
4029
id: "d2ff2c1e-2994-5ca2-8bf3-508213e11364"
4130
og_id: "9ec8fa49-bda9-5e8f-876f-1e53a46d83ca"
4231
testing_pr: 3472
43-
testing_sha: abd489f7280be8b30f9cfcc0ef3d015749ce8fd3
32+
testing_sha: 953a091eb9848dec7c876cf8f3cd00576612df2c

0 commit comments

Comments
 (0)